Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    165s
  • max time network
    177s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/01/2024, 05:49

General

  • Target

    2024-01-10_4a380fbc8f12cffc01f946e7b1c07223_goldeneye.exe

  • Size

    408KB

  • MD5

    4a380fbc8f12cffc01f946e7b1c07223

  • SHA1

    bed45e2ddda481186767f7b5dd8213f0dd54c328

  • SHA256

    58019f8d6b9fdc18d526a39f1b0b1b78c792d1146f7d67f7d14bb187c98da4c7

  • SHA512

    291d902321aac267c9cb50b05d63dbcbaf9df0f49a188a9a2379a230c7609db81a168553d99cdcfc0ec6ccd4f45aff0ffe4f8cc1b55d1f1c5cef2a1b2bb0835f

  • SSDEEP

    3072:CEGh0oOl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGEldOe2MUVg3vTeKcAEciTBqr3jy

Score
8/10

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 24 IoCs
  • Executes dropped EXE 12 IoCs
  • Drops file in Windows directory 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-01-10_4a380fbc8f12cffc01f946e7b1c07223_goldeneye.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-01-10_4a380fbc8f12cffc01f946e7b1c07223_goldeneye.exe"
    1⤵
    • Modifies Installed Components in the registry
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1088
    • C:\Windows\{872391C0-498C-4c7d-A10F-01D9D9A2684B}.exe
      C:\Windows\{872391C0-498C-4c7d-A10F-01D9D9A2684B}.exe
      2⤵
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:8
      • C:\Windows\{1A829D01-BEA0-4238-BF08-0458346EE3F1}.exe
        C:\Windows\{1A829D01-BEA0-4238-BF08-0458346EE3F1}.exe
        3⤵
        • Modifies Installed Components in the registry
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3376
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c del C:\Windows\{1A829~1.EXE > nul
          4⤵
            PID:4292
          • C:\Windows\{32FE0323-7AF7-42b8-9EE1-A63D56B72FAD}.exe
            C:\Windows\{32FE0323-7AF7-42b8-9EE1-A63D56B72FAD}.exe
            4⤵
            • Modifies Installed Components in the registry
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3080
            • C:\Windows\{9ECFE33B-56EC-4a45-9D5E-2D3DD8D21A15}.exe
              C:\Windows\{9ECFE33B-56EC-4a45-9D5E-2D3DD8D21A15}.exe
              5⤵
              • Modifies Installed Components in the registry
              • Executes dropped EXE
              • Drops file in Windows directory
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:316
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c del C:\Windows\{9ECFE~1.EXE > nul
                6⤵
                  PID:1456
                • C:\Windows\{D4BCE1D1-689A-4711-8BC1-34FBAB19AD77}.exe
                  C:\Windows\{D4BCE1D1-689A-4711-8BC1-34FBAB19AD77}.exe
                  6⤵
                  • Modifies Installed Components in the registry
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:4584
                  • C:\Windows\{3898AC27-C901-4261-9818-11C4B5982E0B}.exe
                    C:\Windows\{3898AC27-C901-4261-9818-11C4B5982E0B}.exe
                    7⤵
                    • Modifies Installed Components in the registry
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:2028
                    • C:\Windows\{085DFF69-D016-40df-AC85-43979336F1B2}.exe
                      C:\Windows\{085DFF69-D016-40df-AC85-43979336F1B2}.exe
                      8⤵
                      • Modifies Installed Components in the registry
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:3080
                      • C:\Windows\{AD042B2E-8573-4c31-9E90-27EDA5370DCB}.exe
                        C:\Windows\{AD042B2E-8573-4c31-9E90-27EDA5370DCB}.exe
                        9⤵
                        • Modifies Installed Components in the registry
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:1960
                        • C:\Windows\{A03A545E-69A5-49d5-A06F-AED6EB1C271C}.exe
                          C:\Windows\{A03A545E-69A5-49d5-A06F-AED6EB1C271C}.exe
                          10⤵
                          • Modifies Installed Components in the registry
                          • Executes dropped EXE
                          • Drops file in Windows directory
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:3400
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{A03A5~1.EXE > nul
                            11⤵
                              PID:4352
                            • C:\Windows\{60983C17-CF91-4760-ADD7-04B5DC02C499}.exe
                              C:\Windows\{60983C17-CF91-4760-ADD7-04B5DC02C499}.exe
                              11⤵
                              • Modifies Installed Components in the registry
                              • Executes dropped EXE
                              • Drops file in Windows directory
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              PID:492
                              • C:\Windows\{9944E714-E79B-4387-AF20-3C8F96C3F581}.exe
                                C:\Windows\{9944E714-E79B-4387-AF20-3C8F96C3F581}.exe
                                12⤵
                                • Modifies Installed Components in the registry
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2304
                                • C:\Windows\{E42F8875-22A6-4777-9D0B-3F85FF767880}.exe
                                  C:\Windows\{E42F8875-22A6-4777-9D0B-3F85FF767880}.exe
                                  13⤵
                                  • Executes dropped EXE
                                  PID:1204
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c del C:\Windows\{9944E~1.EXE > nul
                                  13⤵
                                    PID:1344
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c del C:\Windows\{60983~1.EXE > nul
                                  12⤵
                                    PID:1800
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c del C:\Windows\{AD042~1.EXE > nul
                                10⤵
                                  PID:2988
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c del C:\Windows\{085DF~1.EXE > nul
                                9⤵
                                  PID:472
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c del C:\Windows\{3898A~1.EXE > nul
                                8⤵
                                  PID:4820
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c del C:\Windows\{D4BCE~1.EXE > nul
                                7⤵
                                  PID:3472
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c del C:\Windows\{32FE0~1.EXE > nul
                              5⤵
                                PID:4820
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{87239~1.EXE > nul
                            3⤵
                              PID:924
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
                            2⤵
                              PID:4972

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Windows\{085DFF69-D016-40df-AC85-43979336F1B2}.exe

                            Filesize

                            408KB

                            MD5

                            f6c36ee4c2c4a3460842743cfca72543

                            SHA1

                            9060ee400c0dab024014bfcfabfca6ce667f7253

                            SHA256

                            5d71a2abfe7ca7eec58c89a84f0181fa392073089a435c33c7d479209b82e264

                            SHA512

                            12bcaafaeed2f86dfad2d1fd876ca231b799b394e20a7d778d56d030c45e3af7184fa8e7dd9d865e6021bbc9430d846f9e6c79d41289a411c1cd395547333012

                          • C:\Windows\{1A829D01-BEA0-4238-BF08-0458346EE3F1}.exe

                            Filesize

                            384KB

                            MD5

                            a3c35bd707632fc11e79a8065e709bf0

                            SHA1

                            95337de91ba79b821c92719079c0e9c0e59431ff

                            SHA256

                            b064a64890da69a6021a734a4bfb4b404404980a6c9e9d6d9a24dabdc14d5aac

                            SHA512

                            9244ef56736a0209db9e6039bec00435fbaf49dfdc0c193a540bbbc096678036d5a078c76ed88adf6802efe4525b9062c76ed66982f29806d3631fd2d6568359

                          • C:\Windows\{1A829D01-BEA0-4238-BF08-0458346EE3F1}.exe

                            Filesize

                            224KB

                            MD5

                            1af2bc1e55df8525b60831be3a51662d

                            SHA1

                            ab808a192bb9fec648c969244838f97803d760fd

                            SHA256

                            aced5120cc111a2ab664d3808ad826c26b6e6c3cfadfff846a23928fa59c2c5e

                            SHA512

                            4e3d58a8f922a1ecc50df8ca76e309d837edc8fb5836f865558e2ecb9c3344ef350c62aab8e9495b0f6571da943b943ab9218a5fbfcaae53dbdd242304e345a7

                          • C:\Windows\{32FE0323-7AF7-42b8-9EE1-A63D56B72FAD}.exe

                            Filesize

                            408KB

                            MD5

                            8ac076917191f2906316bd163ca73dd9

                            SHA1

                            e4935362bb090138de657cfcb202935cb611bb27

                            SHA256

                            58c87ab4f373c2b3903503db84b42cbd9196ac61fd8063ca6388d9a207ebea66

                            SHA512

                            96caddfd62ba80bbd2282f91b58ee92605718ad7c6abeaa266b77b11021faff5b28f63cf4ef3d797415077bdf4aa41bed087d415471046df5de4f56b7b8e6286

                          • C:\Windows\{3898AC27-C901-4261-9818-11C4B5982E0B}.exe

                            Filesize

                            408KB

                            MD5

                            dff9c8cf3efd4ef2bae7dad5424d2aac

                            SHA1

                            633e51cc7a91164958393c868875d906b36967b7

                            SHA256

                            747c30fa0366f6c976863a9d765035740be64e564598d3a9c78a04e5f1a71d5c

                            SHA512

                            fc32c9db356e25eb7efbae06a17163d9be33ee6c27d7c4b6dcb07dae13809aac66b483f99249226489cee230e6bc8cf2caa494712811b9b8fe533a33f626d3d2

                          • C:\Windows\{60983C17-CF91-4760-ADD7-04B5DC02C499}.exe

                            Filesize

                            408KB

                            MD5

                            ea28e359fc9457646fc346266cf02c9f

                            SHA1

                            6f3fb777907fe5e115058af1722c6c3abf7b3384

                            SHA256

                            856bc617e4411a4aaa58cee7b8a0b4d231288b05389c1c2759affaa652ae967d

                            SHA512

                            26720916fa8528d953b6543926a5de634965eb3673a795a4ecc5b3fb7bcd0bd28eab3c60d6dc398104e13ec6f2a0bf8f0e9d1303d124abe4f211006e564b3350

                          • C:\Windows\{872391C0-498C-4c7d-A10F-01D9D9A2684B}.exe

                            Filesize

                            408KB

                            MD5

                            153dbf8566ee38ff190b074aa839e446

                            SHA1

                            9a834765c82b6ef1b32875f33b8a7587467e95e2

                            SHA256

                            300e4cfd33e3444735c899fc3b70537cbfd16adc9eb6b4c9c318daca5b5a7e60

                            SHA512

                            3137ec0910f7204782dcb924460aa84cc6fc980d1ab05addec022a7611a2d13cea12d2d63d70f3aa108f84d496df4ba2a5cf628a402150bbb3ea3afe96dd4e18

                          • C:\Windows\{9944E714-E79B-4387-AF20-3C8F96C3F581}.exe

                            Filesize

                            408KB

                            MD5

                            6848d412043ff5dc23204b7f63ed4369

                            SHA1

                            328fdd910cda08038a550ae0234baf12c7343563

                            SHA256

                            5cb693fbea14265286798d331336ce18a8d7fc5f70cebc4f2f4f3fa2cf1f6562

                            SHA512

                            aeb0c6096a9b354335ee71f06ed900dc49799a6b798e6fa09430f80bf095f543689396769d70a6dffd8f2e6009e19a0230fc74c426ffceb961230ca76e739f58

                          • C:\Windows\{9ECFE33B-56EC-4a45-9D5E-2D3DD8D21A15}.exe

                            Filesize

                            408KB

                            MD5

                            037e97ac8fc9571c20254cefd495be5f

                            SHA1

                            274dffa16e2e6bf52af27cb2729b5bd26774e169

                            SHA256

                            1f6bbf7b5a3a923173bd61cd663b349f87d02afdb220fc20960bdbf21dd2e4d0

                            SHA512

                            deb5d904cfe2b7254b1a75b9fb62113ae9e4ff4edc5d682adc0b08a792fd574ef1fb829e9356b74abd9cc8c8f19d76b9bfac9598a590f48345673035577f4552

                          • C:\Windows\{A03A545E-69A5-49d5-A06F-AED6EB1C271C}.exe

                            Filesize

                            408KB

                            MD5

                            b28515cbd9e75c70ea39f77fb88b1521

                            SHA1

                            4563a6ae2af9b1094fe4925d4aea27837dfb0259

                            SHA256

                            aa3b73b23885c4cd3118f48b676c8c9057e47686ad062f3f644a29f3ac5b1d92

                            SHA512

                            231be6169b7fba999983d7979054d5ca4b9f5a370d4a2c94f80366eb5031cdd3db37afa60c3e64d7586faed3430bbf977f91025a0ad0763e67768c777a3ff87d

                          • C:\Windows\{AD042B2E-8573-4c31-9E90-27EDA5370DCB}.exe

                            Filesize

                            408KB

                            MD5

                            70aa338743343f9617acaf0101dde594

                            SHA1

                            4fabff0bdc619ee62ba486352cf7733aba8b934a

                            SHA256

                            a9ddb01db5354e90feb4552bed17c1a2e5cecdb3cd8077a790004735a0d688fc

                            SHA512

                            673b421973585ede2671803e2b2dce3432aa28620e72e65f6946e2d1e1101b54ec877b5651ce0a36c2634f06ee2733a0203ee88db31ef84c99c6781132c9b35c

                          • C:\Windows\{D4BCE1D1-689A-4711-8BC1-34FBAB19AD77}.exe

                            Filesize

                            408KB

                            MD5

                            573a6798dc58dbed4d803c5c76973037

                            SHA1

                            5bcba2b90fcd1cb3c7bc4d49b9725aaf494c2fed

                            SHA256

                            1baae8241cf41208a993b1e0591c5c6c1225f36621b1a23b017477d1904466ef

                            SHA512

                            2a8bb5dce7c646d93d95b328523e25652d5eac2cf452e212217ccf3b35bf38d10f4f7ce1e25239b54ff5f20215efb30de5c07a926ad34c40e0c4b51343722bdb

                          • C:\Windows\{E42F8875-22A6-4777-9D0B-3F85FF767880}.exe

                            Filesize

                            408KB

                            MD5

                            9bc308716ec137714e43cbab4a1ce666

                            SHA1

                            31812f5cd0e571fceae74a2d3eba6cb93211c4d6

                            SHA256

                            15e415a1b9f0f8b14518b29d9fc7b49b7985c872114d66263dfe9fb4ad15d0fb

                            SHA512

                            4f6c86db33e59289a7996158f52e5265987a10eb9a0f9273aca6c5796f23538abc25a6b63555c6892bdfaa7ece904fbd1e11f5150a98b8f86153b2f7b6d674d9